Understanding the UAE National Risk Assessment for AML/CFT

The UAE National Risk Assessment (NRA) is a foundational document that shapes the country’s entire AML/CFT framework. Every regulated business must understand the NRA’s findings because they directly inform what regulators expect from your business risk assessment and compliance programme under Federal Decree-Law No. 10 of 2025 on Anti-Money Laundering, Combating Financing of Terrorism and Proliferation Financing (which replaced Federal Decree-Law No. 20 of 2018).

The UAE NRA identifies the country’s key ML/TF threats, vulnerabilities, and risk levels across sectors. Businesses must align their own risk assessments with NRA findings, applying a risk-based approach and proportionate controls to identified risks. ADZ helps businesses translate NRA findings into practical compliance measures using the First Compliance platform.

Key Takeaways

The NRA is the foundation for every business risk assessment in the UAE — regulators including the CBUAE, FSRA, DFSA, SCA, and MOJ expect your programme to be explicitly informed by NRA findings.
The highest-risk predicate offences identified by the NRA — fraud, drug trafficking, corruption, and tax evasion — should shape your transaction monitoring parameters and red flag indicators.
A risk-based approach is not optional: businesses in sectors rated high-risk by the NRA must implement enhanced measures proportionate to that elevated risk.
The NRA’s identification of cash-intensive transactions, complex corporate structures, and real estate as key vulnerabilities means businesses in these areas face heightened supervisory attention.
First Compliance by ADZ allows risk parameters to be configured in direct alignment with NRA findings, ensuring your monitoring reflects the country’s assessed risk landscape.

What Is the National Risk Assessment?

The NRA is a comprehensive evaluation conducted by UAE authorities — coordinating across the CBUAE, FIU, Ministry of Justice (MOJ), and other agencies — to identify and assess the money laundering and terrorist financing risks facing the country. It examines:

Key ML/TF threats and their likelihood, including predicate offences
Vulnerabilities in the financial and non-financial sectors
Risk levels assigned to different sectors and activities
Effectiveness of existing controls and mitigating measures
Alignment with FATF Recommendations

Key NRA Findings

Highest Risk Threats and Predicate Offences

The NRA identifies several predicate offences as posing the highest ML risk to the UAE:

Fraud (including cyber-enabled fraud)
Drug trafficking
Counterfeiting of products
Tax evasion
Corruption and bribery

These predicate offences generate the illicit proceeds that then enter the financial system through placement, layering, and integration — the three core stages of money laundering.

High-Risk Sectors

Banking and financial services (supervised by CBUAE)
Real estate and property transactions
Precious metals and stones dealers
Virtual asset service providers (VASPs, supervised by SCA and VARA)
Corporate service providers (supervised across DFSA, FSRA, and mainland authorities)
Legal professionals and accountants

Key Vulnerabilities

Cash-intensive economy creating placement opportunities
International trade and commerce hub status that can be exploited for trade-based money laundering
Large expatriate population with diverse origins including from FATF higher-risk jurisdictions
Complex corporate structures including free zone entities that can obscure beneficial ownership for layering
Proximity to conflict regions, increasing terrorism financing risk
Use of hawala and other informal value transfer systems

ADZ’s compliance advisory team helps businesses interpret NRA findings and translate them into sector-specific risk assessments that satisfy CBUAE, FSRA, and DFSA expectations.

How the NRA Affects Your Business

Informing Your Risk Assessment

Your business risk assessment must reference and align with NRA findings. If the NRA identifies your sector as high-risk, your compliance programme must reflect this with enhanced measures. Under the risk-based approach mandated by Federal Decree-Law No. 10 of 2025 and Cabinet Decision No. 134 of 2025, failing to account for NRA findings leaves your programme structurally deficient.

Setting CDD Standards

NRA risk ratings influence the level of CDD you should apply. Businesses in high-risk sectors — real estate, VASPs, precious metals — should default to enhanced due diligence, including PEP (Politically Exposed Person) screening and adverse media screening, for most customer relationships.

Shaping Monitoring Parameters

Your transaction monitoring should be calibrated to detect the specific typologies identified in the NRA as relevant to your sector — including structuring (smurfing), hawala-linked transactions, rapid asset transfers, and cross-border remittances to high-risk jurisdictions.

Guiding Resource Allocation

The NRA helps you prioritise where to allocate compliance resources — focusing on the highest predicate offence risks and highest-risk customer segments rather than spreading resources evenly across all areas.

First Compliance by ADZ allows businesses to configure risk scoring and monitoring parameters aligned with NRA findings, ensuring detection capabilities reflect the country’s assessed risk landscape.

Integrating NRA Findings into Your Programme

Reference the NRA explicitly in your business risk assessment with specific citations
Map NRA threats and predicate offences to your specific business activities and customer base
Adjust CDD intensity and monitoring thresholds based on NRA sector risk ratings
Include PEP (Politically Exposed Person) screening and adverse media screening as standard for sectors rated high-risk
Brief staff on NRA findings relevant to their roles — particularly the typologies most common in your sector
Review and update your programme when new NRA findings are published or when FATF issues updated guidance on the UAE

Frequently Asked Questions

Where can I find the UAE National Risk Assessment?

The NRA summary is published by the UAE National Committee for Combating Money Laundering and the Financing of Terrorism and Illegal Organisations. Key findings are also referenced in FATF mutual evaluation reports and supervisory guidance issued by the CBUAE, FSRA, and DFSA.

How often is the NRA updated?

The NRA is updated periodically as new risks emerge and as the threat landscape evolves. The 2026 FATF mutual evaluation of the UAE is expected to prompt an updated NRA and revised supervisory priorities.

Must my business risk assessment reference the NRA?

Yes. Regulators expect business risk assessments to be informed by and consistent with national-level risk findings. A risk assessment that ignores the NRA will be treated as inadequate.

What if my business is in a sector rated high-risk by the NRA?

You must implement enhanced compliance measures proportionate to the elevated risk, including enhanced CDD, PEP screening, adverse media screening, more intensive transaction monitoring, and increased senior management oversight.

How does the NRA relate to the FATF mutual evaluation?

The NRA feeds directly into the UAE’s FATF mutual evaluation. Supervisory bodies use the NRA to calibrate their inspection priorities, meaning businesses in high-risk sectors will face more frequent and rigorous scrutiny.

Align Your Compliance with National Risk Findings

ADZ helps UAE businesses build compliance programmes that are informed by the NRA and proportionate to identified risks. Our advisory services translate NRA findings into sector-specific risk assessments, calibrated monitoring parameters, and CDD frameworks that satisfy CBUAE, FSRA, and DFSA inspectors.

First Compliance by ADZ enables risk assessment configuration, monitoring calibration, and real-time parameter updates when the NRA is revised — keeping your programme aligned with the country’s current risk landscape without manual rework.

Contact ADZ today — visit adilzone.com or reach out to our compliance team.